Bypassing major EDRs using Pool Party process injection techniques

Researchers devised a novel attack vector for process injection, dubbed Pool Party, that evades EDR solutions.

Researchers from cybersecurity firm SafeBreach devised a set of process injection techniques, dubbed Pool Party, that allows bypassing EDR solutions. They presented the technique at Black Hat Europe 2023. 

The experts relied on the less-explored Windows thread pools to discover a novel attack vector for process injection.

The researchers discovered eight new process injection techniques that allowed them to trigger malicious execution as a result of a legitimate operation.

“The techniques were capable of working across all processes without any limitations, making them more flexible than existing process injection techniques. And, more importantly, the techniques were proven to be fully undetectable when tested against five leading EDR solutions.” reads the analysis published by the experts.

The process injection technique consists of a chain of three primitives, for allocating memory on the target process, for writing malicious code to the allocated memory, and for executing the malicious code written.

The researchers tested multiple primitives and determined that EDR solutions detect the process injection mainly through the tracking of the execution primitive. 

The experts focused on the creation of an execution primitive based only on allocation and writing primitives. Searching for the possibility of triggering the execution of malware through a legitimate action the experts analyzed the Windows user-mode thread pool.

Any Windows process has a thread pool by default, and thread pools have both kernel and user-mode code.

The experts speculated that it is possible to abuse worker factories to achieve process injection.

A worker factory is a Windows object that oversees thread pool worker threads, it creates or terminates them as needed. It doesn’t schedule or execute work items, but ensures an adequate number of worker threads.

One of the techniques discovered by the researchers exploits the start routine of worker factories, while the other ones use the three queue types.

“Recalling the queue types, asynchronous work items are queued to the I/O completion queue. The I/O completion queue is a Windows object that serves as a queue for completed I/O operations.” continues the report. “Notifications are inserted into the queue once an I/O operation completes. The thread pool relies on the I/O completion queue to receive notifications when an asynchronous work item’s operation is completed.”

SafeBreach achieved a 100 percent success rate in bypassing the major EDR solutions: 

• Palo Alto Cortex
• SentinelOne EDR
• CrowdStrike Falcon
• Microsoft Defender For Endpoint
• Cybereason EDR

“Though modern EDRs have evolved to detect known process injection techniques, our research has proven that it is still possible to develop novel techniques that are undetectable and have the potential to make a devastating impact.” SafeBreach concludes. “Sophisticated threat actors will continue to explore new and innovative methods for process injection, and security tool vendors and practitioners must be proactive in their defense against them.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, EDR Solutions)